Virus:Win32/Expiro.EK!MTB malicious file

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: 19982D99C547B0256402.mlw
path: /opt/CAPEv2/storage/binaries/8d8e15627d5d97e99f124bf53fb648d34f4d419d8f45f1557a9d4200646c615f
crc32: 5B83E872
md5: 19982d99c547b0256402ee98de04f936
sha1: dc69940fd6dc72fd63e67e0a114a9851cf3cd06b
sha256: 8d8e15627d5d97e99f124bf53fb648d34f4d419d8f45f1557a9d4200646c615f
sha512: fa263a7a1a07ebb5086db58758d502ca9b029cc3ad439771f11d0657320856dbf9382de311f8fd2ce07139b5393489b61dbc46883b6aec09c27030463fe2dbdc
ssdeep: 24576:ezKBX/yhsGeNqEA9bl0fitGbna8FLk2m1X2D4brr:ezKB6N9blI7a8K2mFhbrr
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T10A25E032B5D48575D065A734ADEBF7703BFFF8E24636828B33E805588A25A03CC26752
sha3_384: bc71ca8c6141b096842321669e0d3aa3e66a3056a0b5a0262ef42d52da4df54a93177f6ea9d7009b45c1a21fad89aebe
ep_bytes: e840cc0b00e974feffff3b0d04794500
timestamp: 2023-01-11 11:34:15

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft® Macro Assembler (x64)
FileVersion: 14.29.30148.0 built by: cloudtest
InternalName: ML64.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: ML64.EXE
ProductName: Microsoft® Visual Studio®
ProductVersion: 14.29.30148.0
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.